Jackson mass mailer adds to attack onslaught

More zombies than the Thriller video

By John Leyden, 1st July 2009

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Miscreants have created a Michael Jackson mass-mailing worm.

The malware, which follows a growing list of other hacking attacks in the wake of the superstar's death last week, claims to offer secret songs and photos of Jackson in an attached zip file. In reality, the emails (which claim to come from sarah@michaeljackson.com) offer only malicious code.

Prospective marks duped into opening the infected attachment on Windows machines get infected while further spreading the worm. The malware is also capable of spreading via USB memory sticks. More on the threat can be found in a blog posting by Sophos (here) and Symantec (here).

The mass mailing worm - identified by Symantec as Ackantta-F - spreads in messages that typically bear the subject line "Remembering Michael Jackson."

Ackantta is far from the only item of malware trying to ride on the coat-tails of Michael Jackson's death.

For example, an executable file posted on counterfeit photo-sharing sites was detected by F-Secure last week. The malware tried to established a backdoor on compromised Windows PCs, as explained here.

Separately, a domain loaded with exploit code - supposedly touting Jackson death conspiracy theories - is actually just an outlet for an exploit tool, Sunbelt Software warns. The malicious domain is being promoted via an enthusiastic spamming campaign. ®

Agentless Backup is Not a Myth